[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.1 (NIST 3.3.1)?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

3.3.1 Identification              | and                                                                                | Authentication                                                                |                                    | 3-6                                |                                    |        |        |        |        |        |        |        |        |        |        |
|                   | 3. 3.3.1 Identification and Authentication

Identification and authentication were critical to every system the NIST study team reviewed.

Assessing Federal and Commercial Information Security Needs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity Framework Manufacturing Profile:

| 17     |
| 05-20-2019 | Substantive | Deleted 'and devices' from PR.AC-1 Low security level and Added 'Establish and manage identification mechanisms and credentials for users and devices of the manufacturing system.' to the PR.AC-1 Moderate security level. | 22     |
| 05-20-2019 | Substantive | Changed 'Protect network integrity of the manufacturing system, incorporating network segregation where appropriate.' to 'Protect network integrity of the manufacturing system, incorporating network segmentation and segregation where appropriate.' in PR.AC-5 Low security level. | 24     |
| 05-20-2019 | Substantive | Moved 'Protect the manufacturing system against, or limit the effects of, denial of service attacks.' from the PR.DS-4 Low security level to the PR.DS-4 Moderate and High security levels. | 26     |
| 05-20-2019 | Substantive | Moved 'Heighten system monitoring activity whenever there is an indication of increased risk to manufacturing operations and assets.' from the PR.DS-5 Low security to the PR.DS-5 Moderate and High security levels. | 26     |
| 05-20-2019 | Substantive | Deleted 'Manufacturing systems are often connected to business systems or interconnected. Any single system can be an attack vector for all systems. It is therefore necessary to provide a uniform defense encompassing all baselines.' from PR.IP-8. | 31     |
| 05-20-2019 | Substantive | Changed 'Test response and recovery plans to determine the effectiveness of the plans, and the readiness to execute the plans.' to 'Review response and recovery plans to determine the effectiveness of the plans, and the readiness to execute the plans.' in PR.IP-10 Low security level. | 31     |
| 05-20-2019 | Substantive | Added 'Test response and recovery plans to determine the effectiveness of the plans, and the readiness to execute the plans.' to PR.IP-10 Moderate and High security level.

Cybersecurity Framework Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Guidelines on Firewalls and Firewall Policy:

There are many aspects to firewall management. For example, choosing the type or types of firewalls to deploy and their positions within the network can significantly affect the security policies that the firewalls can enforce. Policy rules may need to be updated as the organization's requirements change, such as when new applications or hosts are implemented within the network. Firewall component performance also needs to be monitored to enable potential resource issues to be identified and addressed before components become overwhelmed. Logs and alerts should also be continuously monitored to identify threats-both successful and unsuccessful. Firewall rulesets and policies should be managed by a formal change management control process because of their potential to impact security and business operations, with ruleset reviews or tests performed periodically to ensure continued compliance with the organization's policies. Firewall software should be patched as vendors provide updates to address vulnerabilities. - GLYPH<c=31,font=/EDBFEN+Webdings> Latest updates to antimalware and personal firewall software
- GLYPH<c=31,font=/EDBFEN+Webdings> Configuration settings for antimalware and personal firewall software
- GLYPH<c=31,font=/EDBFEN+Webdings> Elapsed time since the previous malware scan
- GLYPH<c=31,font=/EDBFEN+Webdings> Patch level of the operating system and selected applications
- GLYPH<c=31,font=/EDBFEN+Webdings> Security configuration of the operating system and selected applications

The diagrams in Figures 3-1 and 3-2 each show a single firewall; however, many implementations use multiple firewalls. Some vendors sell high-availability ( HA ) firewalls, which allow one firewall to take over for another if the first firewall fails or is taken offline for maintenance. HA firewalls are deployed in pairs at the same spot in the network topology so that they both have the same external and internal connections.

Guidelines on Firewalls and Firewall Policy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Computer Security Division 2013 Annual Report:

Supply chain risk management

| Welcome Letter                                                                                | ..................................................................1   |
|----------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|
| Computer Security Division (CSD) Management Team.......2                                                                                |                                                                       |
| Computer Security Division Organization                                                                                | ..........................3                                           |
| The Computer Security Division Implements the Federal Information Security Management Act                                                          | .................7                                                    |
| Program & Project Achievements for Fiscal Year 2013                                                                                | .....9                                                                |
| NIST Responsibilities Under Executive Order 13636, 'Improving Critical Infrastructure Cybersecurity'                                               | ....................10                                                |
| Contributions to National and International Standards Development...........................................................................11     |                                                                       |
| Identity Management Standards within INCITS B10 and ISO JTC1/SC 17 ................................................................

Computer Security Division 2013 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Computer Security Training & Awareness Course Compendium:

| AUDITING ADVANCED INFORMATION TECHNOLOGY | 51 | | AUDITING CLIENT/SERVER TECHNOLOGY | 49 | |------------------------------------------------------------------|------| | AUDITING SYSTEM DEVELOPMENT: NEW TECHNIQUES FOR NEW TECHNOLOGIES | 47 | | AUDITING DATACOMM NETWORKS | 50 | | AUDITING INFORMATION SYSTEMS | 41 | | AUDITING THE SYSTEMS DEVELOPMENT PROCESS | 70 | | BASIC SECURITY FOR PC USERS | 44 | | BASICS OF COMPUTER SECURITY | 18 | | BECOMING AN EFFECTIVE DATA SECURITY OFFICER | 53 | | BUILDING INFORMATION SECURITY AWARENESS | 27 | | BUSINESS RESUMPTION PLANNING (M2046) | 21 | | BUSINESS FRAUD (M2008) | 38 | | BUSINESS IMPACT ANALYSIS | 85 | | BUSINESS IMPACT ANALYSIS (M2044) | 21 | | CASE STUDIES IN MULTILEVEL SECURE NETWORKING | 13 | | COMMUNICATION SECURITY PRINCIPLES & PRACTICES | 66 | | COMMUNICATIONS TECHNOLOGIES | 86 | | COMPREHENSIVE INFOSEC SEMINAR | 66 | | COMPUSEC | 18 | | COMPUTER VIRUSES SEMINAR | 84 | | COMPUTER SECURITY FOR THE END-USER | 80 | | COMPUTER SECURITY | 32 | | COMPUTER SECURITY SEMINAR | 64 | | COMPUTER CRIME & INDUSTRIAL ESPIONAGE | 82 | | COMPUTER SECURITY AWARENESS TRAINING | 3 |

Computer Security Training & Awareness Course Compendium


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.5 (NIST 3.2.5)?

[Assistant]
According to Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices:

3.2.5 Payments Information Type... 3.2.5 Payments Information Type

Payments include disbursements of Federal funds, via a variety of mechanisms, to Federal and private individuals, Federal agencies, state, local and international Governments, and the private sector, to effect payment for goods and services, or distribute entitlements, benefits, grants, subsidies, loans, or claims. 3.2.5.

Guide for Mapping Types of Information and Information Systems to Security Categories_ Appendices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Ransomware Risk Management_ A Cybersecurity Framework Profile provide?

[Assistant]
## NISTIR 8374

## Ransomware Risk Management:

A Cybersecurity Framework Profile

William C. Barker William Fisher Karen Scarfone Murugiah Souppaya

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

<!-- image -->

## NISTIR 8374

## Ransomware Risk Management:

A Cybersecurity Framework Profile

William C. Barker Dakota Consulting Silver Spring, MD

William Fisher

Applied Cybersecurity Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

Murugiah Souppaya

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8374

February 2022

<!-- image -->

U.S. Department of Commerce Gina M. Raimondo, Secretary

## National Institute of Standards and Technology Interagency or Internal Report 8374 28 pages (February 2022)

## This publication is available free of charge from:

https://doi.org/10.6028/NIST.IR.8374

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Ransomware Risk Management_ A Cybersecurity Framework Profile

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

EXECUTIVE SUMMARY .................................................................................................................. IX
Content of the Report ............................................................................................................................ xi
 CHAPTER 1   DOCUMENT DEVELOPMENT STRATEGY ...................................................................1
1.1  Cybersecurity and the Electric Sector ............................................................................................ 4
1.2  Scope and Definitions .................................................................................................................... 5
1.3  Smart Grid Cybersecurity Document Development Strategy ........................................................ 6
1.4  Combined Cyber-Physical Attacks .............................................................................................. 12
 CHAPTER 2   LOGICAL ARCHITECTURE AND INTERFACES OF THE SMART GRID ......................14
2.1  The Seven Domains to the Logical Reference Model ................................................................. 15
2.2  Logical Security Architecture Overview ..................................................................................... 24
2.3  Logical Interface Categories ........................................................................................................ 28
 CHAPTER 3  HIGH-LEVEL SECURITY REQUIREMENTS ...............................................................75
3.1  Cybersecurity Objectives ............................................................................................................. 75
3.2  Confidentiality, Integrity, and Availability Impact Levels .......................................................... 76
Impact Levels for the CI&A Categories ......................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What are the CMMC Level 1 requirements?

[Assistant]
According to Fiscal Year 2023 Cybersecurity and Privacy Annual Report:

<!-- image -->

<!-- image -->

## 2023 Cybersecurity & Privacy Annual Report

## Fiscal Year 2023 Cybersecurity and Privacy Annual Report

Patrick O'Reilly, Editor Computer Security Division Information Technology Laboratory

Kristina Rigopoulos, Editor Applied Cybersecurity Division Information Technology Laboratory

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-229

May 2024

<!-- image -->

U.S. DEPARTMENT OF COMMERCE Gina M. Raimondo, Secretary

<!-- image -->

<!-- image -->

- Cryptography 5

Introduction

4

- Education, Training & Workforce Development 7
- Emerging Technologies 9
- HumanCentered Cybersecurity 11
- Identity & Access Management 13
- Privacy 15
- Risk Management 17
- Trustworthy Networks & Platforms 19
- NIST National
- Cybersecurity Center of Excellence 21

<!-- image -->

<!-- image -->

--------------------------

This year has been one to remember! As we wrapped up our celebration of 50 years of work in cybersecurity, we continued to prioritize our quest for deep collaboration with the community and seamless coordination across NIST throughout 2023. Our research and demonstrated practical applications work spanned across several key priority areas, which are outlined in this report-with hyperlinked pointers to more specifics if you'd like to dig deeper or learn more. NIST's work meshes well with - and is a key part of - the National Cybersecurity Strategy and the related Implementation Plan. NIST is singled out for its work related to international standards, an area that we have prioritized and is yielding notable results. In the same vein, the U.S.

Fiscal Year 2023 Cybersecurity and Privacy Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N provide? (Part 2)

[Assistant]
lar A-130. Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on federal agencies by the Secretary of Commerce under statutory authority.
Nor should these guidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce, Director of the OMB, or any other federal official. This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States. Attribution would, however, be appreciated by NIST. National Institute of Standards and Technology Special Publication 800-178 Natl. Inst. Stand. Technol. Spec. Publ. 800-178, 68 pages ( Octo ber 2016) CODEN: NSPUE2

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-178

Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately. Such  identification  is  not  intended  to  imply  recommendation  or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. Organizations are encouraged to review all draft publications during public comment periods and provide feedback to NIST.

A Comparison of Attribute Based Access Control (ABAC) Standards for Data Service Applications_ Extensible Access Control Markup Language (XACML) and N


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 1 require for Personnel Security?

[Assistant]
According to Security Segmentation in a Small Manufacturing Environment:

| Common Weakness                                                                                | Security Segmentation                                                                                |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Incomplete or nonexistent asset inventory: without an asset inventory, it is difficult to identify vulnerabilities or to mitigate them in devices and on the network. | Security segmentation identifies assets and groups them into security zones, which can help with inventory management. Asset inventory is an intrinsic part of security segmentation.

Security Segmentation in a Small Manufacturing Environment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Measuring the Usability and Security of Permuted Passwords on Mobile Platforms provide? (Part 3)

[Assistant]
## Abstract

Password entry on mobile devices significantly impacts both usability and security, but there is a lack of usable security research in this area, specifically for complex password entry.
To address this research gap, we set out to assign strength metrics to passwords for which we already had usability data, in an effort to have a more meaningful comparison between usability and security. This document reports a method of optimizing the input of randomly generated passwords on mobile devices via password permutation to allow for a comparison of password usability data. We found that the number of keystrokes saved-the efficiency gained-via permutation depends on the number of onscreen keyboard changes required in the original password rather than on password length. Additionally, we created and are releasing Python scripts (publicly available from https://github.com/usnistgov/PasswordMetrics) for the experiments on entropy loss we conducted across passwords ranging in length from 5 to 20 characters. ## Keywords

authentication; mobile devices; onscreen keyboards; password entry; password generation; password permutation; security-usability balance; text entry; usable security

## Acknowledgments

The authors wish to thank their colleagues who reviewed drafts of this report and contributed to its technical content, including Sharon Laskowski, Kerry McKay, Ray Perlner, Andrew Regenscheid, Mary Theofanos, and Meltem Sönmez Turan of NIST. Thank you to Kenneth Thompson and others for assistance with obtaining screenshots of mobile platforms. A very special thanks to Jim Filliben and Andrew Rukhin for their mathematical consultation, and especially to Andrew for his formulas presented in Appendix D. ## Audience

This document is intended for those researchers in the usable security field, regardless of whether their background is primarily usability or primarily security.

Measuring the Usability and Security of Permuted Passwords on Mobile Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Guide to a Secure Enterprise Network Landscape:

- The primary function of the first generation of CASBs was the discovery of resources. They provided visibility into all of the cloud resources that the enterprise users accessed, thus preventing or minimizing the chances of shadow IT. Shadow IT is the practice of some users using cloud applications that are not authorized by the enterprise IT management from home or the office using enterprise desktops. An example of this is the use of unapproved software as-a-service (SaaS) applications for file sharing, social media, collaboration, and web conferencing [4]. This generation of CASBs also provides some statistics, such as software-as-a-service (SaaS) utilization. - The current generation of CASBs enforces security and governance policies for cloud applications, thus enabling enterprises to extend their on-premises policies to the cloud. Specific security services provided by CASBs include:
- o Protection of enterprise data that live in cloud service providers' servers (due to SaaS or IaaS subscriptions), as well as data inflow and data outflow (i.e., Data Loss Prevention [DLP] capabilities) from those servers. - o Tracking of threats, such as account hijacking and other malicious activities, some of which can detect anomalies in users' cloud access behavior (through robust User and Entity Behavior Analytics (UEBA) functionality) and stop insider threats and advanced cyberattacks [5]. - o Detection of misconfigurations in the enterprise's subscribed IaaS and cloud servers. These misconfigurations pose serious security risks, such as data breaches. Alerts generated by CASB due to misconfigurations in the enterprise's IaaS deployments direct the enterprise to follow guidelines, such as the Center for Internet Security's (CIS) benchmarks for public cloud services, thus improving the overall security profile of the enterprise for cloud access [4].

Guide to a Secure Enterprise Network Landscape


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Codes for Identification of Federal and Federally-Assisted Organizations:

This document provides the organizational codes for federal agencies to establish the Federal Agency Smart Credential Number (FASC-N) that is required to be included in the FIPS 201 Card Holder Unique Identifier. SP 800-87 is a companion document to FIPS 201.

CHUID; Federal Agency Smart Credential Number (FASC-N); FIPS 201; HSPD-12; organizational codes; identity credential; PIV cards.

The Homeland Security Presidential Directive HSPD-12 called for new standards to be adopted governing the interoperable use of identity credentials to allow physical and logical access to Federal government locations and systems. Personal Identity Verification (PIV) for Federal Employees and Contractors , (Federal Information Processing Standard 201 (FIPS 201)) was developed to establish standards for identity credentials. This document, Special Publication (SP) 800-87, provides the organizational codes necessary to establish the PIV Federal Agency Smart Credential Number (PIV FASC-N) that is required to be included in the FIPS 201 Card Holder Unique Identifier (CHUID) and is a companion document to FIPS 201.

Codes for Identification of Federal and Federally-Assisted Organizations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to An Introduction to Information Security:

|                                                                                | 6.3 Implement ....................................................................................................... 37                  |
|--------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|
| 6.4 Assess ............................................................................................................ | 37                                                                                |
| 6.5 Authorize......................................................................................................... | 37                                                                                |
| 6.6 Monitor............................................................................................................ | 37                                                                                |
| 7 Assurance.............................................................................................................38           |                                                                                |
| 7.1 Authorization ...................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to BIOS Protection Guidelines:

| Introduction.......................................................................................................................1-1 | | |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | 1.1 | Authority ...................................................................................................................1-1 | | | 1.2 | Purpose and Scope..................................................................................................1-1 | | | 1.3 | Audience ..................................................................................................................1-2 | | | 1.4 | Document Structure .................................................................................................1-2 | | 2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Cybersecurity Framework Version 1.1 Manufacturing Profile:

Analysis | | RS | Respond | RS.MI | Mitigation | | RS | Respond | RS.IM | Improvements | | RC | Recover | RC.RP | Recovery Planning | | RC | Recover | RC.IM | Improvements | | RC | Recover | RC.CO | Communications |

Cybersecurity Framework Version 1.1 Manufacturing Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Guide to Operational Technology (OT) Security:

security control baselines for low-, moderate-, and high-impact OT systems

2.3.4.  Programmable Logic Controller-Based Topologies ..................................................21

3.3.4.  Define OT-Specific Policies and Procedures ...........................................................40

Guide to Operational Technology (OT) Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities:

A security configuration setting is an element of a software's security that can be altered through the software itself. Examples of settings are an operating system offering access control lists that set the privileges that users have for files, and an application offering a setting to enable or disable the encryption of sensitive data stored by the application. A security configuration issue vulnerability involves the use of security configuration settings that negatively affect the security of the software.

CCE-3245-8 in Windows XP is: 'IPSEC Services.' This service can be enabled or disabled. This service can protect the confidentiality and integrity of network traffic, and some IPsec services (such as on Windows systems) also perform packet filtering (firewall capabilities). So if the service is disabled but should be enabled, it could expose the system's network services to unauthorized access from other systems (partial impact on confidentiality) and also permit network traffic to be transmitted without expected confidentiality or integrity protections (partial impact on confidentiality and integrity). Some network communications may require IPsec protection, so in those cases the traffic could not be sent (partial impact on availability). The Privilege Level would be 'Not Defined.'

with the system (e.g., if IPsec is required for communications but unavailable). The Exploitation Method is 'Passive' and Access Complexity is 'Low' because no specific actions need to be performed, and Authentication is 'None'.

The Common Configuration Scoring System (CCSS)_ Metrics for Software Security Configuration Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Technical Guide to Information Security Testing and Assessment:

| 6.4 | Assessment Logistics ..............................................................................................6-4 | Assessment Logistics ..............................................................................................6-4 | | |-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------| | | 6.4.1 | Assessor Selection and Skills.......................................................................6-5 | | | | 6.4.2 | Location Selection ........................................................................................6-6 | | | | 6.4.3 | Technical Tools and Resources Selection | ...................................................6-8 | | 6.5 | Assessment Plan Development.............................................................................6-10 | Assessment Plan Development.............................................................................6-10 | | | 6.6 | Legal Considerations .............................................................................................6-12 | Legal Considerations .............................................................................................6-12 | | | 6.7 | Summary................................................................................................................6-12 | Summary................................................................................................................6-12 | | | 7.

Technical Guide to Information Security Testing and Assessment


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

Public cloud computing represents a significant paradigm shift from the conventional norms of an  organizational  data  center  to  a  deperimeterized  infrastructure  open  to  use  by  potential adversaries. As  with  any  emerging  information  technology  area,  cloud  computing  should  be approached carefully with due consideration to the sensitivity of data. Planning helps to ensure that  the  computing  environment  is  as  secure  as  possible  and  in  compliance  with  all  relevant organizational policies and that privacy is maintained. It also helps to ensure that the agency derives full benefit from information technology spending. To  maximize  effectiveness  and  minimize  costs,  security  and  privacy  must  be  considered throughout the system lifecycle from the initial planning stage forward. Attempting to address security and privacy issues after implementation and deployment is not only much more difficult and expensive, but also exposes the organization to unnecessary risk.

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0:

........................................................ | 1. INTRODUCTION..............................................................................................................................
| 1                                                                                |
| 1.1                                                                                | I DENTIFICATION...........................................................................................................................1                                                                                |                                                                                |
| 1.2                                                                                | OVERVIEW....................................................................................................................................1                                                                                |                                                                                |
| 2. TOE DESCRIPTION......................................................................................................................... | 2. TOE DESCRIPTION.........................................................................................................................

COTS Security Protection Profile - Operating Systems (CSPP-OS) (Worked Example Applying Guidance of NISTIR-6462, CSPP) Version 1.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT):

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems.

-  Connected vehicle IoT enables vehicles, roads, and other infrastructure to communicate and share vital transportation information.
-  Consumer IoT consists of IoT applications in residences as well as wearable and mobile devices.
-  Health IoT processes data derived from sources such as electronic health records and patient-generated health data.
-  Smart building IoT includes energy usage monitoring systems, physical access control security systems and lighting control systems.
-  Smart manufacturing IoT enables enterprise-wide integration of data, technology, advanced manufacturing capabilities, and cloud and other services.

application areas makes it clear that cybersecurity for IoT is unique and requires tailoring existing standards and creating new standards to address challenges, for example: pop-up network connections, shared system components, the ability to change physical aspects of the environment, and related connections to safety.

Interagency Report on the Status of International Cybersecurity Standardization for the Internet of Things (IoT)


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Digital Identity Guidelines_ Authentication and Authenticator Management:

3.2.3. 3.2.3 requires a physical authenticator to be
authenticated along with a biometric comparison. 3.2.3 requires a physical authenticator to be
authenticated along with the biometric comparison.

Digital Identity Guidelines_ Authentication and Authenticator Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI:

Product: Solaris 2.3 CRAY Version R Maintenance Update 1 with Patch

Updates

Updates

Validated Products List 1995 no. 4_ Programming Languages, Database Language SQL, Graphics, POSIX, Computer Security, Product Data - IGES, OSI


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Computer Security Division 2003 Annual Report:

## CONFIGURATION MANAGEMENT AND CONTROL

Federal  agencies  will  be  required  to  use  FIPS Publication  199  standards  to  define  security categories  for  their  information  systems. The recommendations for baseline (minimum) security  controls  from  Special  Publication  80053 can subsequently be used as a starting point for and input to the organization's risk assessment processes and the development of security plans for those information systems. While the FIPS  Publication  199  security  categorization associates  the  operation  of  the  information system with a 'worst-case' impact on an organization's  operations  and  assets  (providing  an upper  bound  on  risk), the  incorporation  of refined  threat  and  vulnerability  information during  the  risk  assessment  process  facilitates the tailoring of the baseline security controls to address organizational needs and tolerance for risk. Deviations from the recommended baseline security controls should be documented (along with  supporting  rationale)  in  the  security  plan for the information system. The use of security controls  from  Special  Publication  800-53  and the incorporation of baseline (minimum) controls as a starting point in the control selection process facilitate a more consistent level of security in an organizational information system. At the same time it offers the needed flexibility  to  fine  tune  and  adjust  the  controls based  on  specific  organizational  policy  and requirements  documents, particular  conditions and circumstances, known threat and vulnerability  information, or  tolerance  for  risk  to  the organization's operations and assets. One of the newer features added to the FASP Web  site  are  IT  product  specific  checklists  for settings and configurations. These checklists are discussed more fully earlier in this report. These checklists are recommendations, not mandatory requirements, and are offered freely to IT professionals.

Computer Security Division 2003 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i:

| Table 6-2. | Summary of Security Claims for Selected EAP Methods ......................................6-11                      |                                                |
|--------------|---------------------------------------------------------------------------------------------------------------------|------------------------------------------------|
| Table 6-3. | Characteristics of Common TLS-Based EAP Methods for WLANs.......................6-12                                |                                                |
| Table 6-4. | Questions for Identifying an Appropriate EAP Method                                                                 | ..........................................6-13 |
| Table 6-5. | EAP Multiplexing Model.........................................................................................6-16 |                                                |
| Table 6-6. | EAP Support Requirements for WLAN Components.............................................6-18                       |                                                |
| Table 7-1. | Wi-Fi Alliance Certification Programs ......................................................................7-2     |                                                |
| Table 7-2. | IEEE 802.11i Features Not Present in WPA............................................................7-3             |                                                |
| Table 8-1. | IEEE 802.11 RSN Security Checklist: Initiation Phase............................................8-3                 |                                                |
| Table 8-2. | IEEE 802.11 RSN Security Checklist: Planning and Design Phase........................8-7                            |                                                |
| Table 8-3.

Establishing Wireless Robust Security Networks_ A Guide to IEEE 802.11i


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Minimum Security Requirements for Multi-User Operating Systems:

| 1.4          | Terminology                                                 | 1-7    |
|           | 1.5          | Document Organization                                       | 1-7    |
| 2.
| Rationale    | Rationale                                                   | 2-1    |
|           | 2.1          | Intended Method of Use                                      | 2-1    |
|           | 2.2          | Environmental Assumptions                                   | 2-1    |
|           | 2.3          | Expected Threats                                            | 2-2    |
|           | 2.4          | Security Features and Assurances                            | 2-2    |
|           |              | 2.4.1 Identification and Authentication                     | 2-3    |
|           | 2.4.2        | Access Control                                              | 2-3    |
|           | 2.4.3        | Audit                                                       | 2-3    |
|           | 2.4.4        | System Integrity                                            | 2-4    |
|           | 2.4.5        | Data Integrity                                              | 2-4    |
|           | 2.4.6        | Reliability of Service                                      | 2-4    |
|           | 2.4.7        | Product Development Assurance                               | 2-4    |
|           | 2.4.8        | Product Documentation Assurance                             | 2-5    |

Minimum Security Requirements for Multi-User Operating Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.2 (NIST 3.3.2)?

[Assistant]
According to Recommendations for Federal Vulnerability Disclosure Guidelines:

3.3.2. 3.3.2. 3.3.2.

Recommendations for Federal Vulnerability Disclosure Guidelines


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.2 (NIST 3.2.2)?

[Assistant]
According to Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management:

3.2.2) will help determine those dependencies. 3.2.2 Three-Point Estimation

One method for considering the likelihood or impact of a risk event is three-point estimation.

Identifying and Estimating Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does A Framework for Designing Cryptographic Key Management Systems provide? (Part 5)

[Assistant]
....................................................................................... | 1. Introduction ..............................................................................................
|
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1.1 Scope of this                                                                                | 1.1 Scope of this                                                                                | Framework........................................................................................ 3                                                                                |
| 1.2 Audience................................................................................................................. | 1.2 Audience.................................................................................................................

A Framework for Designing Cryptographic Key Management Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

There may be references in this publication to other publications currently under development by
NIST in accordance with its assigned statutory responsibilities. The information in this
publication, including concepts and methodologies, may be used by Federal agencies even before
the completion of such companion publications. Thus, until each publication is completed, current
requirements, guidelines, and procedures, where they exist, remain operative. For planning and
transition purposes, Federal agencies may wish to closely follow the development of these new
publications by NIST. The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and
Technology  (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical
leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof of concept implementations, and technical analyses to advance
the development and productive use of information technology. ITL’s responsibilities include the
development  of management,  administrative, technical,  and  physical  standards  and  guidelines
for  the  cost-effective  security  and  privacy  of  other  than  national  security-related  information  in
Federal information systems. EXECUTIVE SUMMARY .................................................................................................................. IX
Content of the Report ............................................................................................................................ xi
 CHAPTER 1   DOCUMENT DEVELOPMENT STRATEGY ...................................................................1
1.1  Cybersecurity and the Electric Sector ............................................................................................ 4
1.2  Scope and Definitions ....................................................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Security Guidelines for Storage Infrastructure:

- Sensitivity (e.g., sensitive vs. non-sensitive)
- Frequency (e.g., frequently accessed vs. non-frequently accessed)
- Environment (e.g., Production vs. Development vs. Testing vs. Staging)

Point-in-time copies, are usually created by the immediate element storing the source data (e.g., storage array, filesystem, database), and are designated for fast recovery and a wide variety of other uses, such as cloning production data for testing purposes. Point-in-time copies can also be taken from remote replicas (and thus can be referred to as 'remote Point-in-time copies').

Unpatched vulnerabilities are unintended software side effects or dependencies not caught by software quality assurance (QA) or testing that, if exploited, present a security risk.

Security Guidelines for Storage Infrastructure


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to PIV Data Model Test Guidelines:

## AS06.01.05: The eContentType of the encapContentInfo shall be id-PIVCHUIDSecurityObject (OID = 2.16.840.1.101.3.6.1).

## AS06.01.13: The signedAttrs of the SignerInfo shall include the pivSigner-DN (OID = subject name that appears in the X.509 certificate for the entity that signed the CHUID. 2.16.840.1.101.3.6.5) attribute containing the

## .101.3.6.7). AS06.01.16: The digital signature certificate used to sign the CHUID shall in the extKeyUsage assert id-PIV-content-signing (OID = 2.16.840.1


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Maintenance?

[Assistant]
According to Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks:

- IoT sensor data, representing measurements of the physical world, always has uncertainties associated with it. Effective management of IoT sensor data, including understanding uncertainties, is necessary to assess data quality and meaning so the organization can make decisions regarding the data's use and avoid introducing new risks. Without this, error rates may be unknown for the different contexts in which an IoT device might be used. 1 Effective IoT sensor data management is important when mitigating physical attacks on sensor technology, such as attacks performed through wireless signals, that could cause sensors to produce false results. - The ubiquity of IoT sensors in public and private environments can contribute to the aggregation and analysis of enormous amounts of data about individuals. These activities can be used to influence individuals' behavior or decision-making in ways they do not understand, or lead to information being revealed that individuals did not want revealed, including the re-identification of previously de-identified PII-and may be beyond the originally intended scope of the IoT device's operation. - IoT devices with actuators have the ability to make changes to physical systems and thus affect the physical world. The potential impact of this needs to be explicitly recognized and addressed from cybersecurity and privacy perspectives. In a worst-case scenario, a compromise could allow an attacker to use an IoT device to endanger human safety, damage or destroy equipment and facilities, or cause major operational disruptions. Privacy concerns and related civil liberties concerns could arise through authorized changes to physical systems that could impact individuals' physical autonomy or behavior in personal and public spaces.

Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control:

Organizations should provide adequate staffing with the appropriate training such that support is available in a timely manner (consistent with thresholds defined in the organization's business plan). Stakeholders are advised to use other Functions within the Cybersecurity Framework to inform the identification and prioritization procedures. For example, while testing business continuity procedures, use the findings to identify which resources of the mission were impacted and to what degree, and | [NIST-SP800-37r2] [NIST-SP800-53r5] AC-20, CP-2, CP-8, RA-2, RA-9, SA-20, SC-6                                                                                |
| ID.AM-6 : Cybersecurity roles and responsibilities for the entire workforce and third- party stakeholders (e.g., suppliers, customers, partners) are established                                                                                | Organizations should assign cybersecurity roles and responsibilities for the ground systems. The roles and responsibilities for third-party stakeholders and collaborative partners (such as organizations that own or operate payloads that are hosted) are determined on a case-by-case basis. | [NIST-SP800-53r5] CP-2, PM-2, PM-29,PS-2, PS-7                                                                                |
| Identify: Business Environment Category The organization's mission, objectives, stakeholders, and activities are documented, reviewed, and prioritized. This information is used to inform cybersecurity roles, responsibilities, and risk management decisions. | Identify: Business Environment Category The organization's mission, objectives, stakeholders, and activities are documented, reviewed, and prioritized.

Satellite Ground Segment_ Applying the Cybersecurity Framework to Satellite Command and Control


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Automation Support for Security Control Assessments_ Software Asset Management:

Traceability of SWAMControl Items to Example Attack Steps................... A-1                                                                                |
| Appendix B. Keyword Rules Used to Identify Controls that Support SWAM....................B-1                                                                                |
| False Positives................................................................................................................ C-1 Appendix D. Control Items Not in the Low, Moderate, or High Baselines......................... D-1 |
| Appendix E. SWAM-Specific Acronyms and Abbreviations* ..............................................E-1                                                                                |
| Appendix F. Glossary ................................................................................................................F-1                                                                                |
| Appendix G. Control Items Affecting Desired and/or Actual State from All Defect Checks in this Volume................................................................................................................G-1               |

Automation Support for Security Control Assessments_ Software Asset Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms provide? (Part 3)

[Assistant]
today's cloud data centers and edge computing, attack surfaces have significantly increased, cyber attacks are industrialized, and most security control implementations are not coherent or consistent.
The foundation of any data center or edge computing security strategy should be securing the platform on which data and workloads will be executed and accessed. The physical platform represents the foundation for any layered security approach and provides the initial protections to help ensure that higher-layer security controls can be trusted. This report explains an approach based on hardware-enabled security techniques and technologies for safeguarding container deployments in multi-tenant cloud environments. It also describes a prototype implementation of the approach intended to be a blueprint or template for the general security community. ## Keywords

cloud; container; hardware-enabled security; hardware root of trust; platform security; trusted compute pool; virtualization. ## Audience

The primary audiences for this report are security professionals, such as security engineers and architects; system administrators and other information technology (IT) professionals for cloud service providers; and hardware, firmware, and software developers who may be able to leverage hardware-enabled security techniques and technologies to improve container deployment in multi-tenant cloud environments. ## Trademark Information

All registered trademarks or other trademarks belong to their respective organizations. ## Patent Disclosure Notice

NOTICE: ITL has requested that holders of patent claims whose use may be required for compliance with the guidance or requirements of this publication disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL calls for patents and ITL has not undertaken a patent search in order to identify which, if any, patents may apply to this publication.

Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Cloud Computing Synopsis and Recommendations:

| Executive Summary.................................................................................................................
1   |
|----------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
| 1. | Introduction.................................................................................................................... | Introduction....................................................................................................................

Cloud Computing Synopsis and Recommendations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Workshop on Enhancing Security of Devices and Components Across the Supply Chain:

The National Institute of Standards and Technology (NIST) hosted an in-person, all-day workshop on February 27, 2024, to discuss existing and emerging cybersecurity threats and mitigation techniques for semiconductors throughout their life cycle. The workshop obtained valuable feedback from industry, academia, and government to inform NIST's development of cybersecurity and supply chain standards, guidance, and recommended practices. The discussion focused on semiconductor development and highlighted cybersecurity measurements and metrics that utilize reference data sets to facilitate the testing, attestation, certification, verification, and validation of semiconductor components. It also emphasized the use of automated cybersecurity tools and techniques to secure manufacturing environments throughout the development life cycle. This report summarizes the content that was presented and discussed at the workshop. These activities range from physical protection mechanisms (e.g., tamper-resistant packaging) to strong encryption protocols to safeguard data. Secure boot processes ensure that only verified firmware runs, and maintaining supply chain integrity through verification and audits prevents counterfeit components. Life cycle management includes secure provisioning, updates, and end-of-life processes that are complemented by rigorous security testing and compliance with regulatory standards. Educating users on secure practices and continuously improving security measures further fortifies defenses against evolving threats and ensures that semiconductor devices operate securely throughout their life cycle. The last panel member was Matthew Areno, Senior Principal Engineer for Intel Corporation. Matthew admitted that there is no industry standard to describe the phases of the supply chain for ICs.

Workshop on Enhancing Security of Devices and Components Across the Supply Chain


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Recommended Cybersecurity Requirements for Consumer-Grade Router Products:

- Multiple signatures for software update packages when possible. At a minimum, all software update packages should be signed by the source of the update (e.g., manufacturer). When applicable (e.g., when routers are leased from internet service providers (ISPs) other entities, such as the owning ISP, may also cryptographically sign updates, adding another layer of security. Routers would only apply a software update if the cryptographic signatures from both the manufacturer and ISP are verified. Cosigning by the ISP also gives the ISP a mechanism to manage the acceptance of software updates. - Robust security for protecting logs of captured cybersecurity state information. Cybersecurity State Awareness, documented in Appendix A, is essential for detecting compromised routers. Because logs can be a valuable tool for security researchers and others performing forensic analysis of cybersecurity incidents, this data needs to be stored securely. Protections that can enhance router log security include encrypting and password protecting logs to ensure that access is limited to authorized personnel only, use of non-volatile memory storage for logs, off-device storage for logged data, and restricting log deletion. | SSDF Task                                                                                | Recommended for Router…               |
|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------|
| PO.1.1: Identify and document all security requirements for the organization's software development infrastructures and processes and maintain the requirements over time. | Firmware, Mobile App., Web App.

Recommended Cybersecurity Requirements for Consumer-Grade Router Products


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities provide? (Part 5)

[Assistant]
edge and skills for security awareness professionals within the federal government. The following is a high-level overview of these results, with statistics from the survey unless otherwise indicated.
## Security Awareness Duties and Work Roles

- 90% of survey participants performed security awareness duties on a part-time basis, with just over 55% spending 25% or less of their time. Focus group participants had similar allocations: 93% part-time and 39% spending 25% of less time. - 50% of survey participants either did not know or were not sure of their National Initiative for Cybersecurity Education (NICE) Workforce Framework for Cybersecurity (NICE Framework) Work Role. This was despite the Federal Cybersecurity Workforce Assessment Act which requires federal agencies to assign the NICE Framework coding structure to its cybersecurity and information technology (IT) positions. Those participants who knew their Work Role identified 11 unique Work Roles. ## Professional Backgrounds

- Participants were diverse in their educational backgrounds, with 83% from focus group and 51% from the survey indicating that they have at least one non-STEM degree. - 92% of survey participants had worked in cybersecurity positions and 76% had worked in IT jobs that did not have a cybersecurity focus. Less than 25% had worked in a variety of

\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

other fields, including non-IT fields such as instructional design and education, communications, and human resources. We found that 40% of participants had only ever worked in a technical field (cybersecurity, IT, or software development). ## Knowledge and Skills

- Survey participants rated the importance of having specific knowledge and skills represented on their teams.

The Federal Cybersecurity Awareness Workforce_ Professional Backgrounds, Knowledge, Skills, and Development Activities

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Security Guidance for First Responder Mobile and Wearable Devices:

| 1 Introduction ............................................................................................................1   | 1 Introduction ............................................................................................................1                                                                  | 1 Introduction ............................................................................................................1   |
|--------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | 1.1 Purpose                                                                                | .......................................................................................................... 1                   |
|                                                                                | 1.2 Scope.............................................................................................................. | 2                                                                                |
|                                                                                | 1.3 Document Structure........................................................................................

Security Guidance for First Responder Mobile and Wearable Devices


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Security Considerations for Voice Over IP Systems:

- Separate voice and data on logically different networks if feasible. Different subnets with separate RFC 1918 address blocks should be used for voice and data traffic, with separate DHCP servers for each, to ease the incorporation of intrusion detection and VOIP firewall protection
- At the voice gateway, which interfaces with the PSTN, disallow H.323, SIP, or other VOIP protocols from the data network. Use strong authentication and access control on the voice gateway system, as with any other critical network component. Strong authentication of clients towards a gateway often presents

- difficulties, particularly in key management. Here, access control mechanisms and policy enforcement may help. -  A mechanism to allow VOIP traffic through firewalls is required. There are a variety of protocol dependent and independent solutions, including application level gateways (ALGs) for VOIP protocols, Session Border Controllers, or other standards-based solutions when they mature. -  Stateful packet filters can track the state of connections, denying packets that are not part of a properly originated call. (This may not be practical when multimedia protocol inherent security or lower layer security is applied, e.g., H.235 Annex D for integrity provision or TLS to protect SIP signaling.)
-  Use IPsec or Secure Shell (SSH) for all remote management and auditing access. If practical, avoid using remote management at all and do IP PBX access from a physically secure system. - If performance is a problem, use encryption at the router or other gateway, not the individual endpoints, to provide for IPsec tunneling. Since some VOIP endpoints are not computationally powerful enough to perform encryption, placing this burden at a central point ensures all VOIP traffic emanating from the enterprise network has been encrypted. Newer IP phones are able to provide Advanced Encryption System (AES) encryption at reasonable cost.

Security Considerations for Voice Over IP Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide for Conducting Risk Assessments:

3 While federal agencies are required to follow certain specific NIST Special Publications in accordance with OMB policy, there is flexibility in how agencies apply the guidance. Federal agencies apply the security concepts and principles articulated in the NIST Special Publications in accordance with and in the context of the agency's missions, business functions, and environment of operation. Consequently, the application of NIST guidance by federal agencies can result in different security solutions that are equally acceptable, compliant with the guidance, and meet the OMB definition of adequate security for federal information systems. Given the high priority of information sharing and transparency within the federal government, agencies also consider reciprocity in developing their information security solutions. When assessing federal agency compliance with NIST Special Publications, Inspectors General, evaluators, auditors, and assessors consider the intent of the security concepts and principles articulated within the specific guidance document and how the agency applied the guidance in the context of its mission/business responsibilities, operational environment, and unique organizational conditions. - Individuals with information security/risk assessment and monitoring responsibilities (e.g., system evaluators, penetration testers, security control assessors, risk assessors, independent verifiers/validators, inspectors general, auditors). Organizations may explicitly define how established priorities and values guide the identification of high-value assets and the potential adverse impacts to organizational stakeholders. If such information is not defined, priorities and values related to identifying targets of threat sources and associated organizational impacts can typically be derived from strategic planning and policies. For example, security categorization levels indicate the organizational impacts of compromising different types of information.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Recommendation for Random Number Generation Using Deterministic Random Bit Generators provide?

[Assistant]
## NIST Special Publication 800-90A Revision 1

## Recommendation for Random Number Generation Using Deterministic Random Bit Generators

Elaine Barker John Kelsey

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-90Ar1

## C  O  M P U  T E R S E C  U  R  I T Y

<!-- image -->

## NIST Special Publication 800-90A Revision 1

## Recommendation for Random Number Generation Using Deterministic Random Bit Generators

Elaine Barker John Kelsey

Computer Security Division Information Technology Laboratory

This publication is available free of charge from: http://dx.doi.org/10.6028/NIST.SP.800-90Ar1

June 2015

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology Willie May, Under Secretary of Commerce for Standards and Technology and Director

## Authority

This publication has been developed by NIST to further its statutory responsibilities under the Federal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3541 et seq. , Public Law (P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A-130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority.

Recommendation for Random Number Generation Using Deterministic Random Bit Generators


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Attribute Considerations for Access Control Systems:

- Encryption
- Measures taken to detect unintended alteration of attribute values
- Data stores on a network behind a proper defense-in-depth posture
- Policies enforced on the attribute update, copy, revoke, or modify process
- Logged and audited change of attribute

- Security protocols are used for transmitting both attribute requests and attribute values to the  attribute  provider  or  access  control  function  (e.g.,  transmitting  in  the  clear  without encryption versus PKI-enabled TLS sessions). - Replay attack protection is typically accomplished by including information provided by the access control function into the signed message that is provided by the remote access control function or attribute provider. This guarantees the integrity and confidentiality of the attribute. - Transmitted attributes are applied in a multi-tier receipt of attributes (i.e., when attributes are sent by remote access control function or provider such that the assured attribute can be  passed  through  the  chain  of  forwarding  routes). For  example,  for  higher  levels  of assurance, using digitally signed attributes (crypto-binding) provides a hash of the attribute to ensure that it has not been altered or tampered with before it is received.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security Considerations for Remote Electronic UOCAVA Voting:

.. 4             | 2 GENERAL ARCHITECTURE............................................................ 4             | 2 GENERAL ARCHITECTURE............................................................
4             |
| 2.1                                                                                | SYSTEM COMPONENTS                                                                                | ....................................................................4                            |
| 2.2                                                                                | AUTHORIZED USERS.......................................................................7         |                                                                                |
| 2.3                                                                                | THREAT SOURCES..........................................................................8        |                                                                                |
| 3 OVERVIEW................................................................................ 12    | 3 OVERVIEW................................................................................ 12    | 3 OVERVIEW................................................................................ 12    |
| 4                                                                                | CONFIDENTIALITY....................................................................

Security Considerations for Remote Electronic UOCAVA Voting


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Hardware-Enabled Security_ Policy-Based Governance in Trusted Container Platforms:

| 27 | | Appendix E- Supporting NIST SP 800-53 Security Controls and Publications | ...30 | | Appendix F- Cybersecurity Framework Subcategory Mappings..........................32 | | | Appendix G-Acronyms and Other Abbreviations .................................................33 | | | List of Tables | List of Tables | | Table 1: VMs Instantiated on the VMware-Based Management Cluster | .......................21 | | Table 2: VMs Instantiated on the KVM-Based Managed Cluster | ..................................22 | | Table 3: Security Capabilities Provided by the Prototype..............................................30 | | | Table 4: Mapping of Security Capabilities to NIST SP 800-53 Controls........................31 | | | List of Figures | List of Figures | | Figure 1: Concept of Trusted Pools.................................................................................7 | | | Figure 2: Stage 1 Solution Overview...............................................................................8 | | | Figure 3: Stage 3 Solution Architecture.........................................................................10 | | | Figure 4: Stage 4 Solution Architecture.........................................................................13 | | | Figure 5: Prototype Implementation Architecture | ..........................................................15 | | Figure 6: Remote Attestation Protocol...........................................................................17 | | | Figure 7: Prototype Architecture....................................................................................19 | | | Figure 8: MCM Console to Import a Cluster..................................................................23 | | | Figure 9: Managed Cluster Policies...............................................................................24 | | | Figure 10: Creating Pipeline for Image Decryption........................................................26 | | | Figure 11: Sample JWT Created by


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Research Report_ User Perceptions of Smart Home Privacy and Security:

3.2.3                                                    | Government Access                                        | 15              |
|                                                          | 3. 3.2.3 Government Access

Several participants were concerned about national governments gaining access to smart home data, especially audio and video.

Research Report_ User Perceptions of Smart Home Privacy and Security


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Directions in Security Metrics Research provide? (Part 2)

[Assistant]
ndation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
## Abstract

More than 100 years ago, Lord Kelvin insightfully observed that measurement is vital to deep knowledge and understanding in physical science. During the last few decades, researchers have made various attempts to develop measures and systems of measurement for computer security with varying degrees of success. This paper provides an overview of the security metrics area and looks at possible avenues of research that could be pursued to advance the state of the art. Keywords: Security Metrics; Computer Security, Security Evaluation

## Acknowledgements

This report received the support of many individuals. The author is grateful to Tim Grance for suggesting the topic and encouraging its development. The author also wishes to thank colleagues who reviewed drafts of this document and contributed to its technical content, as well as the individuals who reviewed the public-release draft of this document and provided comments during the review period. Improvements to the content would not have been possible without their feedback and valuable suggestions. In particular, Paul Black, Lee Badger, and Russell Cameron Thomas offered useful and thought-provoking insight on the subject matter. However, the author takes full responsibility for any remaining errors or omissions in the report. ## Table of Contents

| 1.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Awareness and Training?

[Assistant]
According to Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy:

n the RMF; information resources as system and system elements; authorization boundaries; security and privacy posture; and security and privacy considerations related to supply chain risk management.
- Chapter Three describes the tasks required to implement the steps in the RMF including: organization-level and information system-level preparation; categorization of information and information systems; control selection, tailoring, and implementation; assessment of control effectiveness; information system and common control authorization; the ongoing monitoring of controls; and maintaining awareness of the security and privacy posture of information systems and the organization. - Supporting Appendices provide additional information and guidance for the application of the RMF including:
- -References;
- -Glossary of Terms;
- -Acronyms;
- -Roles and Responsibilities;
- -Summary of RMF Tasks;
- -System and Common Control Authorizations;
- -Authorization Boundary Considerations; and
- -System Life Cycle Considerations.

Risk Management Framework for Information Systems and Organizations_ A System Life Cycle Approach for Security and Privacy


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

which those internal controls are enacted (the 'control environment'), they also perform a risk assessment to identify conditions that may prevent the effective application of those internal controls.
Business managers and system owners select and implement security and privacy control activities (e.g., those described in SP 800-53, Security and Privacy Controls for Information Systems and Organizations ) to achieve the desired objectives and monitor their effectiveness [8]. Fig. 5 illustrates that the terms control , assess , and monitor are used at all three hierarchy levels yet include different activities.

Prioritizing Cybersecurity Risk for Enterprise Risk Management